UK firms see AI as key to resilience, cyber gap grows
UK organisations still define business resilience mainly in cyber security terms, even as senior leaders rank automation and AI as the leading drivers of resilience, according to new research commissioned by Six Degrees and supported by Microsoft.
The study, called the Business Resilience Index, surveyed 600 senior UK IT and security leaders across six sectors. It set out a five-tier maturity model for resilience, from At Risk to Strategically Resilient. It assessed organisations across five areas: Continuity, Security, Scalability, Efficiency, and Innovation.
The research found that overall maturity remains low. It reported fragility in continuity and security. It also identified a small minority of organisations that treat resilience as a platform for advantage rather than a defensive function.
When respondents described business resilience in their own words, 71% referenced security-related themes. The study also reported that 91% of respondents said the broader definition used in the research challenged their thinking.
Automation focus
The findings pointed to a shift in how leaders view what underpins resilience. Automation and AI ranked as the top drivers of resilience. They scored ahead of incident response, recovery and continuity planning in the research.
The study framed this as a move away from a narrow focus on minimising loss. It reported a growing emphasis on speed of decision-making and organisational responsiveness.
Continuity concerns
Continuity emerged as the weakest pillar in the Index. The research classified 28% of organisations as At Risk in this area. It also reported average uptime across critical business services of 73% over the past 12 months.
The study also compared indicators across sectors. It reported an average mean time to recover of 9.7 hours in the tech sector. It said this was around three hours slower than retail.
Security gap
Security performance also showed a split between common practices and higher maturity. The study said quarterly penetration testing was common among respondents. It also found that only 5% of organisations qualified as Strategically Resilient for security, which it defined as fully proactive and governance-led.
The research also highlighted third-party resilience as an undervalued area. It referenced recent UK supply chain incidents as part of its assessment of this risk category.
Sector barriers
The Index pointed to different barriers by sector and by role. Manufacturers most often cited budgets as a constraint. Retail respondents highlighted culture. Public sector respondents pointed to skills. IT leaders cited scenario planning and capability gaps. Security teams pointed to silos and under-investment.
Across the full dataset, the research identified leadership alignment as the biggest unlock. It said under-investment in risk and technology ranked as the top barrier overall. It also reported that only 8% of respondents blamed financial health for resilience shortfalls. It said board commitment ranked tenth among barriers.
Six Degrees said the Index provides a benchmark and a way for organisations to assess themselves against peers. The study also drew on eight qualitative C-suite interviews alongside the survey results.
Six Degrees operates in managed services and cyber security. Microsoft supported the research.
Six Degrees CEO Vince DeLuca said boards may overestimate resilience because of a narrow focus on defensive measures.
"True resilience isn't simply about avoiding failure; it's about enabling your organisation to move faster, scale faster, and recover faster," said Vince DeLuca, CEO, Six Degrees. "We commissioned this study because the market needs objective data. Boards may believe they are resilient, but the data tells a different story. Real competitive advantage only comes when resilience is treated as a strategic priority and reinforced by advanced technologies - such as AI, automation and cost insight."